RH

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
U	Abyssus	razerhid.exe	"Razer Abyssus gaming mouse driver - required if you use the additional features and programmed keys/macros"
U	Ai Gear Help	GearHelp.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme)
U	Arctosa	razerhid.exe	"Razer Arctosa gaming keyboard driver - required if you use the additional features and programmed keys/macros"
X	BIE	"Rundll32.exe [path] BDSrHook.dll	Rundll32"
X	ccAppr	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
U	Copperhead	razerhid.exe	"Razer Copperhead gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	Csrss Host	csrhost.exe	"Added by the IRCBOT.BIZ WORM!"
U	Cyberhawk	CHTray.exe	"Cyberhawk from Novatix. Protects against viruses
U	DeathAdder	razerhid.exe	"Razer DeathAdder gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	Diam prlaer	oqedrhg.exe	"Added by the SDBOT-DEU WORM!"
U	Diamondback	razerhid.exe	"Razer Diamondback 3G gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	errorhandler	errorhandler.exe	"ErrorHandler adware"
U	Habu	razerhid.exe	"Microsoft Habu (by Razer) gaming mouse driver - required if you use the additional features and programmed keys/macros"
U	Hermes Messenger	DGDRHE~1.EXE	"A LAN messenger alternative to WinPopUp - Digital Dreams Software"
U	Hitman Pro SurfRight Helper	srhelper.exe	"Hitman Pro - a utility to start a number of Security Protection software. They can be started individualy"
U	HornetMonitor	MntrHrnt.exe	"Hornet Monitor - monitoring system that detects and responds to unauthorized access attempts and sources of channel interference on any local DSSS network"
U	HP Gaming Keyboard	razerhid.exe	HP VoodooDNA Gaming Keyboard (powered by Razer) driver - required if you use the additional features and programmed keys/macros
U	Internet Disk Cleaner	CLEARH~1.EXE	"""Internet Disk Cleaner from Elongsoft ""protects your privacy by cleaning up all Internet tracks and past computer activities"""
U	Jomantha	razerhid.exe	"Belkin n52te (powered by Razer) gaming keypad driver - required if you use the additional features and programmed keys/macros"
U	Krait	razerhid.exe	"Razer Krait gaming mouse driver - required if you use the additional features and programmed keys/macros"
U	Lachesis	razerhid.exe	"Razer Lachesis gaming mouse driver - required if you use the additional features and programmed keys/macros"
U	Lycosa	razerhid.exe	"Razer Lycosa gaming keyboard driver - required if you use the additional features and programmed keys/macros"
X	Microsoft IT Update	Rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Network Neighbourhood	networknbh.exe	"Added by the RBOT.DMN WORM!"
X	Microsoft Windows Update	scrhost.exe	"Added by the RBOT-AOW WORM!"
X	Microsoft Windows Update	rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	MprHTML	MprHTML.exe	"Added by a variant of the VAGRNOCKER TROJAN!"
X	MS Config Loader	svcrhost.exe	"Added by a variant of the RBOT WORM!"
X	MSNavWH	MSWkwrH.exe	"Added by the ANAV-A WORM!"
X	Msupdate	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	OfficeAgent	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
U	Program Neighborhood Agent	pnagent.exe	"Citrix Program Neighborhood Agent"
U	razer	razerhid.exe	"Razer gaming mouse/keyboard driver - required if you use the additional features and programmed keys/macros"
U	Reclusa	razerhid.exe	"Microsoft Reclusa (by Razer) gaming keyboard driver - required if you use the additional features and programmed keys/macros"
X	Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B}	RH.DLL	"SmartPops search hijacker"
U	RH	rh32.exe	EuroFonts - adds Euro symbols to pre-Euro computers
X	Rhg	rundll32.exe	"Added by the LINEAG-BIT TROJAN! Note - this is not the legitimate rundll32.exe process
X	Rhino	[random name]32.exe	"Added by the BOFRA.A WORM!"
U	RhinoBlocker	RhinoBlocker.exe	"RhinoBlocker - pop-up stopper"
N	RHPTray	RHPTray.exe	"System tray access to Red Hot Pawn - online chess"
N	RHSI SHS	SHS.exe	"Rogers Hi-Speed Internet software. ""Should you ever lose access to your Rogers Hi-Speed Internet connection or e-mail
U	Salmosa	razerhid.exe	"Razer Salmosa gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	Scheduler	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	Security Update Service Process	svrhost23.exe	"Added by the AGOBOT-GN WORM!"
X	SicherheitsTool	SysRep.exe	"SicherheitsTool
X	SuperHeissSex	SuperHeissSex.exe	"HeissSex premium rate adult content dialer!"
X	Symantec Secure Server	svrhost.exe	"Added by the IRCBOT-UB TROJAN!"
X	System Updater Machine	crhwss.exe	"Added by the CIADOOR-DQ TROJAN!"
U	Tarantula	razerhid.exe	"Razer Tarantula gaming keyboard driver - required if you use the additional features and programmed keys/macros"
X	Tok-Cirrhatus	IDTemplate.exe	"Added by the RONTOKBRO.A WORM!"
X	Tok-Cirrhatus	smss.exe	"Added by the BRONTOK-A WORM and variants! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%"
X	Tok-Cirrhatus	[path to file]	"Added by the BRONTOK-F WORM!"
X	Tok-Cirrhatus-1464	br3951on.exe	"Added by the BRONTOK.AD WORM!"
X	Tok-Cirrhatus-1959	br4941on.exe	"Added by the BRONTOK-J WORM!"
X	Tok-Cirrhatus-1959	[random].exe	"Added by the BRONTOK-CF WORM!"
X	Tok-Cirrhatus-1959sarc	sv711224030r.exe	"Added by the BRONTOK-R WORM!"
X	Tok-Cirrhatus-1959sarc	yesbron.com	"Added by the BRONTOK-R WORM!"
X	Tok-Cirrhatus-2454	br5931on.exe	"Added by the BRONTOK.AD WORM!"
X	Tok-Cirrhatus-2784	br6591on.exe	"Added by the BRONTOK-L WORM!"
X	Tok-Cirrhatus-2784	smss.exe	"Added by the BRONTOK-S WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%"
X	Tok-Cirrhatus-[4 random digits]	br[4 random digits]on.exe	"Added by the BRONTOK-M WORM!"
X	VideoDriverHook	vmdriver.exe	"Added by the BCKDR-PSS BACKDOOR!"
U	WatcherHelper	WaHelper.exe	"Sierra Wireless Watcher™ - wireless configuration utility"
X	Windows Driver Sup	windvrhost.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Runtime Help	WinRunHelp.wrh	"Added by a variant of the AIMVISION TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.